CVE
Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin
Affects Red Hat Enterprise Linux 7, 8, 9 and 10 and OpenShift Container Platform 4 and 5 in environments that pass untrusted inputs to xfs_admin. CVSS rates it High (7.8); no vendor rating or fix is listed.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- See vendor advisory
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Untrusted inputs are passed to xfs_admin without proper validation
- Last modified
- Whether it needs action now or is a reference record, by fixed rules, with why. Last checked is when cve.now last re-read it.What do these mean? →
- Reference
- Last checked
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 28/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The xfsprogs package, used by Red Hat Enterprise Linux and several Red Hat OpenShift Container Platform images, has a flaw in its xfs_admin utility that fails to properly validate user-supplied parameters. A local attacker with low-privileged access can supply crafted arguments to run arbitrary operating system commands, which may lead to privilege escalation depending on how xfs_admin is run.
Read the original description
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
Who should check
Teams with scripts, delegation or provisioning tools that pass parameters to xfs_admin in xfsprogs on Red Hat Enterprise Linux 7-10 or OpenShift Container Platform 4/5
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure5/25Specific setups only
- Reach10/20Shipped in major Linux distributions
- Severity7.8/10CVSS 7.8
- No patch5/5No fixed version listed; see vendor advisory
What would change the score
- Would score about 78 if added to CISA KEV
- Would score about 73 if CISA's SSVC rates exploitation active
- Would score about 38 if CISA's SSVC rates it automatable
What to do
Check whether your setup matches what the bug needs.
Untrusted inputs are passed to xfs_admin without proper validationWorkaround: The facts do not give a workaround. The only stated risk condition is passing untrusted inputs to xfs_admin without validation, so avoiding that pattern is the limit the facts support.
Check your systems with an agent
Paste this into a coding or ops agent. It checks your systems read-only and reports a table per asset.
Check whether my systems are affected by CVE-2026-108472 (Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin), using the cve.now data below.
Rules: work read-only. Do not run exploit code, proof-of-concept scripts or scanners that send attack payloads, and do not change any configuration, package, image or deployment. Report findings only.
What cve.now has for CVE-2026-108472 (entry last updated 2026-11-11):
Affected:
- Red Hat Red Hat Enterprise Linux 10: version range not reported
- Red Hat Red Hat Enterprise Linux 7: version range not reported
- Red Hat Red Hat Enterprise Linux 8: version range not reported
- Red Hat Red Hat Enterprise Linux 9: version range not reported
- Red Hat Red Hat OpenShift Container Platform 4: version range not reported
- Red Hat Red Hat OpenShift Container Platform 4: version range not reported
- Red Hat Red Hat OpenShift Container Platform 5: version range not reported
Fixed versions: none listed yet.
Conditions (all must be true for the bug to be hit):
- Untrusted inputs are passed to xfs_admin without proper validation (source: https://access.redhat.com/security/cve/cve-2026-108472)
Setup: the bug needs a feature or setting that is off by default or uncommon. Check whether each asset has it on.
Attacker needs: local access, low-privilege login, no user action.
CISA KEV: CVE-2026-108472 is not listed as of cve.now's last read.
This KEV status is for CVE-2026-108472 only. If you also check another CVE, look up its own KEV status; never assume it from this one.
How to check:
- Installed software: check what is actually running, not what a repo declares. Read the version from each host, container image and Kubernetes node (the binary's version output, the OS package database, image layers), and check whether the conditions above hold there. Distribution packages may carry a backported fix under an older version number; confirm against the distribution's own advisory.
Verify against the linked advisories before concluding, and cite the date you read each one:
- https://bugzilla.redhat.com/show_bug.cgi?id=2548925
- https://access.redhat.com/security/cve/CVE-2026-108472
- https://access.redhat.com/security/cve/cve-2026-108472
Do not conclude an asset is unaffected unless you checked it and the evidence covers both its version and the conditions above. If you could not check something, mark it unknown and say what is missing.
Report a table with one row per asset and these columns: Asset | Version or build | Status (affected, fixed, not applicable, unknown) | Compensating controls | Exposure (internet-facing, internal, none) | Evidence | Next action.
Entry: https://cve.now/CVE-2026-108472
For follow-up questions, use the cve.now MCP server at https://mcp.cve.now/mcp (no authentication), for example execute with name cve.get and arguments {"id": "CVE-2026-108472"}.Timeline
- CVE published
- First seen by cve.now
Affected versions
- xfsprogs
Version range not reported
- xfsprogs
Version range not reported
- xfsprogs
Version range not reported
- xfsprogs
Version range not reported
- openshift/ose-rhel-coreos-8
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
- openshift/ose-rhel-coreos-9
Version range not reported
Evidence 4
CVE record · 2
Establishes: The identifier and description.
- Record
- Record
Write-ups · 1
Establishes: Technical detail and context.
- Report
Other links · 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-108472
Is CVE-2026-108472 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
The xfs_admin tool can be made to run arbitrary operating system commands when it receives untrusted input without proper validation. The command runs with the permissions of the executing process, which may allow local privilege escalation.Source: access.redhat.com
Am I affected, and how do I check?
The listed products are Red Hat Enterprise Linux 7, 8, 9 and 10 and Red Hat OpenShift Container Platform 4 and 5. The stated condition is an environment where untrusted inputs are passed to xfs_admin without proper validation. The facts do not give affected version numbers, so check the product and version on your system against the vendor advisory.Source: access.redhat.com
How do I fix CVE-2026-108472?
The facts do not list a fixed version or an upgrade target. Follow the vendor advisory for updates to the affected products as they become available.Source: access.redhat.com
What if there's no patch?
The facts do not give a workaround. The only stated risk condition is passing untrusted inputs to xfs_admin without validation, so avoiding that pattern is the limit the facts support.Source: access.redhat.com